Hi Kim,
I agree with your assessment of GoDaddy holding onto domains after having them checked for availability on their site. I have a client who specializes in internet marketing and we uncovered this rather unsavory fact after some digging and it's been documented both on the net and I have seen it happen personally, so good for you for exercising caution in that regard.
Secondly, I agree with Tess regarding Bob's "highly unusual method of securing a site for his client". Regardless of who is hosting the client's domain, the domain belongs to the client and should be registered as such. Doing anything other than this would be unethical and I would agree that your Dad (like many before him

) has been taken advantage of. I also agree that he doesn't have much recourse, except to hope that he can recover it eventually, I wish him luck.